Skip to content
This repository has been archived by the owner on Aug 15, 2023. It is now read-only.

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground πŸš€

License

Notifications You must be signed in to change notification settings

Pluto-tv/kubernetes-goat

Β 
Β 

Repository files navigation

Kubernetes Goat

Kubernetes Goat

✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security πŸš€

πŸ™Œ Refer to https://madhuakula.com/kubernetes-goat for the guide πŸ“–

Netlify Status License: MIT GitHub release Github Stars PRs Welcome Docker Pulls Kubernetes Goat Twitter Discord

Kubernetes Goat Home

βš™οΈ Setting up Kubernetes Goat

  • Ensure you have admin access to the Kubernetes cluster and installed kubectl. Refer to the docs for installation
  • Ensure you have the helm package manager installed. Refer to the docs for installation
  • To set up the Kubernetes Goat resources in your cluster, run the following commands
git clone https://github.com/madhuakula/kubernetes-goat.git
cd kubernetes-goat
bash setup-kubernetes-goat.sh
  • Ensure the pods are running before running the access script
kubectl get pods

all pods running in kubectl get pods

  • Access the Kubernetes Goat by exposing the resources to the local system (port-forward) by the following command
bash access-kubernetes-goat.sh

Refer to https://madhuakula.com/kubernetes-goat/docs/how-to-run for setting up Kubernetes Goat in various environments like GKE, EKS, AKS, K3S, KIND, etc.

πŸ† Scenarios

  1. Sensitive keys in codebases
  2. DIND (docker-in-docker) exploitation
  3. SSRF in the Kubernetes (K8S) world
  4. Container escape to the host system
  5. Docker CIS benchmarks analysis
  6. Kubernetes CIS benchmarks analysis
  7. Attacking private registry
  8. NodePort exposed services
  9. Helm v2 tiller to PwN the cluster - [Deprecated]
  10. Analyzing crypto miner container
  11. Kubernetes namespaces bypass
  12. Gaining environment information
  13. DoS the Memory/CPU resources
  14. Hacker container preview
  15. Hidden in layers
  16. RBAC least privileges misconfiguration
  17. KubeAudit - Audit Kubernetes clusters
  18. Falco - Runtime security monitoring & detection
  19. Popeye - A Kubernetes cluster sanitizer
  20. Secure network boundaries using NSP

πŸ“– Documentation Guide

Here is the detailed step by step documentation guide for learning and playing around with Kubernetes Goat πŸŽ‰

Kubernetes Goat Documentation Guide

Reference: https://madhuakula.com/kubernetes-goat

⚠️ Disclaimer

Kubernetes Goat has intentionally created vulnerabilities, applications, and configurations to attack and gain access to your cluster and workloads. Please DO NOT run alongside your production environments and infrastructure. So we highly recommend running this in a safe and isolated environment.

Kubernetes Goat is used for educational purposes only, do not test or apply these attacks on any systems without permission. Kubernetes Goat comes with absolutely no warranties, by using it you take full responsibility for all the outcomes.

πŸ“ License

MIT

✨ Acknowledgements

Thanks go to these wonderful people πŸŽ‰

madhuakula
madhuakula
apvarun
apvarun
ant4g0nist
ant4g0nist
phpsystems
phpsystems
mkcn
mkcn
macagr
macagr
rewanthtammana
rewanthtammana
avicoder
avicoder
NF997
NF997
smoyer64
smoyer64
wurstbrot
wurstbrot
podjackel
podjackel
adamhurm
adamhurm
0xCardinal
0xCardinal

About

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground πŸš€

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • HTML 84.0%
  • JavaScript 7.8%
  • CSS 4.5%
  • Shell 1.3%
  • Dockerfile 0.9%
  • TypeScript 0.8%
  • Other 0.7%